PHP2Shell: LA FALLA QUE DEJÓ 22 MILLONES DE SERVIDORES EXPUESTOS - RedUSERS

PHP2Shell: LA FALLA QUE DEJÓ 22 MILLONES DE SERVIDORES EXPUESTOS - RedUSERS

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page ar/news/redusers/noticias-publicaciones-pllhp2she, snapshot 20261102T122013Z. Copied byte for byte; every file's sha256 is in captures/20261102T122013Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

An Argentine IT-magazine summary (RedUSERS) of a longer paid guide on PHP2Shell, which it says left 22 million servers exposed. It says the two CVE ids group four core PHP errors with a common cause, that three teams reached the same flaw separately in August with the help of AI agents, that there were leaks before the 21 October patch and more than a hundred Dutch organisations took sites down, among them DigiD, and that the closing was messy. Practical points: many distributions fix without changing the version number so the full package string must be compared; the console's PHP can differ from the web server's; updating a package does not help until services restart; the corrected versions have known problems, among them an error with SimpleXML objects, so logs should be watched in the first hours; and updating does not clean a previous intrusion, so logs and upload folders should be checked for signs of one.

> Por último, actualizar no limpia una intrusión previa.

_Curator's translation:_ "Lastly, updating does not clean up a previous intrusion."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: LA FALLA QUE DEJÓ 22 MILLONES DE SERVIDORES EXPUESTOS - RedUSERS". Selected mechanically, not read by a person.

Capture notes

Language es. The capture shows no publication date. A summary of a paid guide, with the full technical detail behind a subscription; the description of how the errors work, one variant's behaviour and the temporary configuration measures are not copied. The page ends with unrelated promotions. Nothing in the page addresses an AI or hides text from a reader.